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Abstract 

This paper demonstrates that existing slice-based measures can reasonably be mapped to the 
field of state-based specification languages. By making use of Z specifications this contribution 
renews the idea of slice-profiles and derives coupling and cohesion measures for them. The measures 
are then assessed by taking a critical look at their sensitiveness in respect to modifications on the 
specification source. The presented study shows that slice-based coupling and cohesion measures 
have the potential to be used as quality indicators for specifications as they reflect the changes in the 
structure of a specification as accustomed from their program-related pendants. 


1 Introduction 

In one of the rare articles concerning the relation between specifications and code, Samson, Nevill, and 
Dugard [13] demonstrate a strong quantitative correlation between size-based specification metrics and 
the related pendant of software code. Their assumption is that a meaningful set of (complexity and 
quality) measures could help in estimating product measures and development effort at a much earlier 
stage. Complexity can be described by size-based attributes, but is it reasonable to measure the quality 
of a specification? This contribution takes a closer look at this problem. 

Quality considerations are sophisticated. Besides the question of what a ’’good specification” looks 
like, quality-based measures (as in use with program code) arc not so easily transformed to specifications. 
One reason is that such measures arc usually based on control/data dependency considerations - concepts 
that arc either not at all or only implicitly available. However, various authors demonstrated in [1 1, 4, 10, 
17] that a reconstruction of the necessary dependencies ameliorates the situation and enables continuative 
techniques like slicing and chunking. And with that, slice-based measures (which arc often taken as the 
basis for quality considerations) can be mapped to formal specifications, too. What would be the benefits 
of such measures? 

As presumed by Samson et. al., with experiences from a large collection of specifications and imple- 
mentations at hand, product and development estimates could be calculated at much earlier stages. But 
there is another benefit. When the measures are sensitive and react instantly to changes in the specifica- 
tions, considerations, e.g. concerning deterioration effects, could be made, too. 

The main objective of this contribution is now to investigate whether slice-based quality measures 
can reasonably be transformed to formal specifications. It does not invent new measures, but it maps 
the ideas behind the definitions of coupling and cohesion measures to the world of formal specification 
languages. Additionally, it looks for possible limitations. Based on Z [14], the mapping is described in 
some details and the outcome is assessed in respect to its expressiveness and sensitiveness. 

This paper is structured as follows: Section 2 introduces specification slices and takes them as the 
basis for the slice-based measures mentioned above. Section 3 discusses the effects on the measures by 
making use of sample specifications, and Section 4 concludes the work with a short outlook. 
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2 Background 

The motivation behind analyzing slice-based coupling and cohesion measures goes back to a paper of 
Meyers and Binkley [8]. In their empirical study they take a closer look at these measures and demon- 
strate that the values of coupling and cohesion can also be used for assessing deterioration effects. As 
formal specifications evolve, too, it would be interesting to see whether changes in the specification code 
show a si mi lar behavior of these measures. As a necessary first step, a reasonable transformation of the 
original definitions of the measures to the world of formal specifications has to be found. This section 
demonstrates how this can be done for Z [14]. 

2.1 Slice-based Coupling and Cohesion 

Coupling is a measure for the strength of inter-component connections, and cohesion is a measure for the 
mutual affinity of sub-components of a component. Within the range of this contribution we arc interested 
in how these measures arc calculated and what they indicate. As adumbrated in the introduction, a 
practical way in calculating coupling and cohesion measures is to make use of slices. 

Weiser [15, 16] introduced five slice-based measures for cohesion: Tightness, Coverage, Overlap, 
Parallelism, and Clustering. Ott and Thuss [12] partly' formalized these measures, and this contribution 
makes use of their formalization. Coupling was originally defined as the number of local information 
flow entering (fan-in) and leaving (fan-out) a procedure [7]. Harman et. al demonstrate in [6] that it 
can also be calculated via slicing. Furthermore, they show that the use of slices not only enables the 
detection of coupling, it can also be used to determine the ’’bandwidth” of the existing information flow. 
Their notion of information flow is also used in this contribution. 

2.2 Specification Slices and Slice Profiles 

For the calculation of coupling and cohesion measures, sets of slices and their intersections (comparable 
to the use of slice profiles in [12]) are needed. For state-based specifications the technique of slicing 
was introduced by Oda and Araki [11], informally redefined by Chang and Richardson [4], and then 
refined by Bollin [1]. His Java prototype has been extended in the recent years. It now supports slicing, 
chunking, and concept location of Z specifications [3]. The technical details of the identification of 
dependencies are not relevant within the scope of this paper, but the basic idea is quite simple: 

First, the specification is dismantled into its basic elements called primes 1 by making use of the CZT 
parser [9]. The primes arc mapped to a graph called SRN (for Specification Relationship Net). Then, 
by following the approach of Chang and Richardson and Bollin [4, 1] control and data dependencies arc 
reconstructed (via a syntactical approximation to the semantical analysis). The SRN gets annotated by 
this dependency information, yielding an Augmented SRN ( ASRN for short). 

The ASRN serves the same purpose as the system dependence graph used by the approaches de- 
scribed in [8, p.4]. Based on this data structure, slicing works as follows: a set of vertices (representing 
the point of interest) in the ASRN is taken as starting point, and, by following the dependencies existing 
in the graph, further primes are aggregated, resulting in the designated specification slice. The trans- 
formation between a specification l P and its ASRN is defined in a bijective manner. So, when talking 
about a specification it can be either the textual representation (consisting of a set of primes) or its ASRN 
representation (consisting of vertices representing the primes). 


1 Basicafly, primes are the predicates of the specification and are later represented as vertices in an augmented graph. When 
they represent predicates of the precondition of a schema they are called precondition primes, and when they form predicates 
that represent after-states they are called postcondition primes. 
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Harman et. al [6] and Ott and Thuss [12] use different types of slices for their calculation of coupling 
and cohesion values. This situation is dealt with hereinafter by generating two valiants of the static 
specification slices: for coupling the slices arc calculated by following the dependencies in a transitive 
backward manner, for the values of cohesion the slices are calculated by combining the dependencies 
in a forward and backward manner. Specification slices and slice profiles (the collection of slices for a 
specific schema operation) are then defined as follows: 

Definition 1. Static Specification Slice. Let T be a formal Z specification, i // one schema out of T, and V a set 
of primes v out of 1 //. SSlicefb( yt, V) is called static forward/backward specification slice of yt for primes V. It is 
calculated by generating a transitive forward and backward slice with V as the starting point of interest. When the 
slice is generated in a transitive and backward manner, it is called static backward slice SSliceb(yt , V). 

Definition 2. Slice Profile, Slice Intersection, Slice Union. Let T be a formal Z specification, \ft one schema out 
ofW, and V the set of primes v representing all postcondition primes in yt. The set of all possible static specification 
slices (SSlicefb(yt, {v}) or SSlicebfyt , {v}), with v £ V) is called Slice Profile (SP(yt)). The intersection of the slices 
in SP(yt) is called Slice Intersection (SPj n ,(yf)). The union of all slices in SP(yt) is called Slice Union (SU(yt)). 


2.3 Cohesion 


With the introduction of slice profiles it is possible to provide the definitions of cohesion measures (as 
introduced in the work of Ott and Thuss [12]). The values for cohesion are calculated only for a given 
schema. As slices and slice profiles might contain primes from other schemata (due to inter-schema 
dependencies), the following definitions restrict the set of primes in the slice profile to the schema. 

Definition 3. Tightness. Let T be a formal Z specification, \ ft one schema out of 'F, SP(yt) its slice profile, and 
SPint(w) i ts slice intersection. Then Tightness 'c(yt) is the ratio of the size of the slice intersection to the size of iff. 
It is defined as follows: 

| SPinfiy) n yt I 

{r,= — m — 

Definition 4. MinCoverage, Coverage, MaxCoverage. Let T be a formal Z specification, yt one schema out 
of'P, and SP(yt) its slice profile containing n slices. MinCoverage Cov m j n (yt) expresses the ratio between the 
smallest slice SPi- m i n in SP(yt) and the number of predicate vertices in \ jf. Coverage Cov(yt) relates the sizes of 
all possible specification slices SPj (SPj £ SP(yt)) to the size of yt. MaxCoverage Cov max (yt ) expresses the ratio 
of the largest slice SPj- max in the slice profile SP(yt) and the number of vertices in yt. They are defined as follows: 

1 1 " I SP n i/r I 1 

Cov mn , ( yt) = -j r | SP j—min I yt | Cov( y / ) = — \\ i j Cov, nax (yt) — 7 r | SPj— max r yt 

| yt | n r-j | yt \ \y/\ 

Definition 5. Overlap. Let T be a formal Z specification, yt one schema out of'-V, SP(yt) its slice profile containing 
n slices, and SPi„ t its slice intersection. Then Overlap O(yt) measures how many primes are common to all possible 
specification slices SPj (SPj £ SP(yt)). It is defined as follows: 


o(yt) 


1 ” | SPjnt n yt | 
n g I SPj n yt I 


Tightness measures the number of primes that are common to every slice. The definition is based on 
the size 2 of the slice intersection. Coverage is split into three different measures: Minimum Coverage 
looks at the size of the smallest slice and relates it to the size of the specification, Coverage looks at 
the size of the slices, but it takes all slices and compares them to the size of the specification, and 
Maximum Coverage looks at the size of the largest slice and relates it to the size of the specification. 
Finally, Overlap looks at the slice intersection and determines how many primes are common to all 
slices. 

2 Please note that within the context of all definitions size counts the number of primes in the ASRN. 
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2.4 Coupling 


The calculation of coupling follows the definitions to be found in [6]. First, Inter-Schema Flow F is 
specified. It describes how many primes of the slices in the slice union are outside of the schema. Inter- 
Schema Coupling then computes the normalized ratio of this flow in both directions. 


Definition 6. Inter-schema Flow and Coupling. Let *P be a formal Z specification and I jf s and \f/ t i two schemata 
out of'i'. Inter-Schema Flow between the two schemata F{yt S iVd) is the ratio of the primes of SUififj) that 
are in \jf s and that of the size of \ff s . Inter-Schema Coupling between the two schemata C(v/ S , y/^/) measures the 
Inter-Schema Flow in both directions. They are defined as follows: 


F(Ws,Wd) 


| suffifd) n y Vs | 

I Vs I 


C{Vs,Vd) 


F{y s , Vd) x | y /, | + F(Vd, Vs) *\Vd\ 
I Vs I + I Vd I 


Schema coupling is calculated by considering the Inter-Schema Coupling values to all other schemata. 


Definition 7. Schema Coupling. Let *F be a formal Z specification and (//, one schema in *F. Then Schema 
Coupling xiVi) is the weighted measures of the Inter-Schema Coupling ofYi to all other n schemata \ j/j in *F \ I 
It is defined as follows: 


X(Vi) 


Lj=i c (VhVj ) x\Vj\ 
LjU I Vi I 


With the measures in this section it is possible to assign attributes to a formal Z specification. How- 
ever, with the mapping a connection to quality has been so far not empirically justified. On the other 
hand, the slice-based measures have carefully been transformed to Z. There is a chance that, when ob- 
serving changes of these values for a given specification, one might defer useful properties. 


3 Sensitivity of Slice-based Measures 

By following the strategy that Thuss and Ott [12] used for their validations, we now investigate the 
sensitivity of the measures with respect to representative changes of the specifications. The advantage is 
that for such a study only small-sized sample specifications are necessary to explore the effects. 

3.1 Sensitivity of Cohesion 

The first objective is to determine whether the transformed measures for cohesion are sensitive to changes 
in the internal structure of the specification. The following operations are considered: 

01 Adding a precondition-prime. This means that this prime ’’controls” the evaluation of the other 
primes in the schema. With it, the internal semantic connections arc extended. Mapped to a 
potential implementation, this could mean that an if-clause is added to the code, enveloping all 
other statements in the method. This operation should slightly increase coverage. 

02 Adding a prime that specifies an after-state and that is not related to all the other predicates in the 
schema. In this case the predicate introduces new ’’trains of thought”. Mapped to a subsequent 
implementation, this could mean that a new output- or state -relevant statement (not or only frac- 
tionally related to the other statements) is added. With it, a new slice is added to the slice-profile. 
The slice intersection is very likely smaller than before, thus reducing the values for cohesion. 

03 Adding a prime that specifies an after-state and that is furthermore related to all other primes in 
the schema. In this case the predicate extends existing ’’trains of thought” (as there arc references 
to all existing ones). Mapped to a possible implementation, it is very likely that a new output- or 
state -relevant statement, related to all other statements, is added. If at all, this increases the set of 
intersection slices. And with that, it also raises the values of coupling. 
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Figure 1: Z specifications of raising sizes. On the left side of the table the slices (and thus the slice- 
protile) arc visualized, on the right side the values for cohesion are presented. 


Based on the assumption that schema operations arc often mapped to methods (or procedures) as 
described in operations 01 to 03, the following working hypothesis can be posted: 

Hypothesis 1. A structural change of type 01, 02 or 03 in a schema operation influences the values 
for cohesion. Adding a predicate prune to the schema according to operations 01 or 03 increases the 
values (or leaves them unchanged), adding a prime according to operation 02 decreases the values (or 
leaves them unchanged). Reversing the operations also reverses the effect on the measures. 

There are situations where, due to a large number of dependencies, a method or a schema operation 
already has reached the maximum values for cohesion. These special cases are the reason why the values 
might also be unchanged (and Sec. 3.3 reconsiders this issue in more details). 

Hypothesis 1 is now checked by using small sample schema operations (called Test I to Testl in 
Fig. 1). At first let us start with a simple Z schema operation called Test 1 . It contains a prime that 
increases the value of n by one. As there is only one slice, the slice intersection only contains one 
element. The values of cohesion arc all 1. Then another prime (in' = m + 1, prescribing an after-state) is 
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added to the schema (which is an operation of class 02), yielding operation Test!. With this new prime 
a new ’’functionality” has been introduced to the schema. The values for cohesion arc reduced as the 
slice intersection is empty. Tightness and Overlap arc zero, the rest of the values arc equal to Then, 
in Test3, the prime delta ? > 0 is added to the schema. This prime is a precondition prime and thus the 
operation belongs to class 01. With this, all the values of cohesion increase. As the slice intersection 
contains one prime only {delta! > 0), its size is #SP- mt { y/) = 1. With that, the values for cohesion result 
in. T — CoVfnifi — ^ x 2, Cov — ^ x (3 3 )’ Oo s max — 3 x 2 , and 0 — ^ x f ^ f ^ ) ■ 

TestA adds another precondition prime set! / 0 to the schema (operation 01). This yields an increase 
in the values of cohesion. The reason is the increase in size of the slice intersection. Test5 adds another 
prime containing an after state identifier to the schema operation. The prime p' = p + delta! is not related 
to the other primes prescribing after-states, so this change is an operation of class 03. The size of the 
slice intersection stays the same, only the size of the schema increases. As a result the values for cohesion 
decrease. 

Now let us take a look at situations when predicates that are partly related to existing predicates 
arc added to the schema. Test6 is an extension of TestA, but this time the new prime p' = p + n uses 
the identifier n which is also defined by the postcondition prime n' = n + delta!. On the other hand it 
does not refer to the third postcondition prime in' = m — delta!, and so the operation belongs to class 
02. The values for cohesion consequently decrease. On contrary, Testl is a modification of Test!. The 
prime in' = m — it is added, and so it is related to all other postcondition primes in the schema. With this 
operation the values for cohesion increase, again. 

Due to reasons of space the example schemata above only contain simple predicates. But they are 
sufficient to demonstrate the influence of structural changes. In Z there are several schema operators 
that complicate the situations, but by further analyzing the formulas of the measures one observes the 
following behavior: 

• Cohesion will increase when (a) at least one postcondition exists and a precondition prime is added, 

(b) a postcondition prime that is related to some, but not to all, other postcondition primes in the 
schema is added, (c) a postcondition prime that is not related to the other postcondition primes is 
removed. 

• Cohesion stays the same when (a) a postcondition prime that is related to all other existing postcon- 
dition primes is added or removed and the other existing primes are already fully inter-related, (b) 
a pre- or postcondition prime is added and there is no postcondition prime. 

• Cohesion will decrease when (a) a postcondition prime that is not related to the other postcondition 
primes is added, (b) a precondition prime is removed and there is at least one postcondition prime, 

(c) a postcondition prime that is related to the other postcondition primes is removed. 

The values for a derived implementation would very likely react to these changes in the same way, so 
the sample specifications and the analysis of the formulas seems to confirm our working hypothesis. The 
measures arc sensitive to changes in the underlying specification, and the observed changes arc in such 
a way that an increase in internal connectivity also leads to an increase of the values of the measures. 
Conversely, a decrease in connectivity also leads to a decrease of the values of cohesion. 

3.2 Sensitivity of Coupling 

The next step is the evaluation of coupling. As mentioned above, specification coupling measures the 
mutual interdependence between different schemata. According to Harman et. al [6] it is an advantage 
to use slice-based measures as they measure the ’’bandwidth” of the information flow. In our case, this 
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Figure 2: Z example for analyzing the effect of slice-based coupling and values for coupling and cohesion 
for the six Z schemata (omitting the FullDB operation schema). 


flow is defined as the relative amount of the size of a set of slices of one schema that lies inside another 
schema. This flow depends upon control- and data-relationships, so an increase in the number of these 
dependencies should increase the value of coupling. Reducing the number of relations should decrease 
the value of coupling. There arc no differences between the definitions of the measure, be it for traditional 
programs or be it for formal specifications. 

The next hypothesis focuses on the sensitiveness to structural changes within a formal Z specification. 
Especially, an increase (or decrease) in inter-schema relations should be reflected correctly 3 . 

Hypothesis 2. A change in the number of relations between two schemata in a formal specification 
generally leads to a change in the value of coupling. Adding a predicate prime to one schema that 
introduces new dependencies to primes in the other schema increases the value of coupling (or leaves it 
unchanged). Reversing the change also reverses the effect on the measure. 

For our considerations we now make use of a small specification (see Fig. 2) which is an extension 
(and intentionally unfinished version) of the birthday-book specification out of Spivey [14, pp.3-6]. 

The specification consists of one state space called BB (for Birthday Book) which stores the names of 
friends, their birthday dates, and a small gift. Consequently, there arc two operations ( Add and AddGift) 
for adding them to the database. The operations are not total, but arc sufficient for our examinations. In 
order to analyze the effect of added pre- and postcondition primes, these operations arc available in two 
versions. Finally, there is an operation called Success which should (later on) indicate the success of an 
operation. However, at the moment this operation is not related to any of the other operations. 

The values of schema coupling are summarized in Fig. 3. As expected, the Success operation has a 
value of coupling equal to zero. There are no connections to the state space BB and also no connections 

3 Again, there are situations where, due to a high number of dependencies, the vaiue of coupiing might stay unchanged. 


Proceedings of NFM 2010, April 13-15, 2010, Washington D.C., USA. 


30 




Slice-based Formal Specification Measures 


A. Bollin 


F 

( 51 ) 

( 52 ) 

( 53 ) 

( 54 ) 

( 55 ) 

( 56 ) 

( 51 ) 

1.000 

1.000 

1.000 

0.000 

1.000 

1.000 

( 52 ) 

0.750 

1.000 

0.750 

0.000 

0.750 

0.750 

( 53 ) 

0.800 

0.800 

1.000 

0.000 

0.800 

0.800 

( 54 ) 

0.000 

0.000 

0.000 

1.000 

0.000 

0.000 

( 55 ) 

0.750 

0.750 

0.750 

0.000 

1.000 

0.750 

( 56 ) 

0.800 

0.800 

0.800 

0.000 

0.800 

1.000 


c 

( 51 ) 

( 52 ) 

( 53 ) 

( 54 ) 

( 55 ) 

( 56 ) 

( 51 ) 

1.000 

0.800 

0.833 

0.000 

0.800 

0.833 

( 52 ) 

0.800 

1.000 

0.778 

0.000 

0.750 

0.778 

( 53 ) 

0.833 

0.778 

1.000 

0.000 

0.778 

0.800 

( 54 ) 

0.000 

0.000 

0.000 

1.000 

0.000 

0.000 

( 55 ) 

0.800 

0.750 

0.778 

0.000 

1.000 

0.778 

( 56 ) 

0.833 

0.778 

0.818 

0.000 

0.778 

1.000 


Figure 3: Values for Inter-Schema Flow F(Yi , y/ 2 ) and Inter-Schema Coupling C(i//i , 1 // 2 ). The abbrevi- 
ations SI to 56 refer to the schema names mentioned in Fig. 2. 


to the other operation schemata. On the other hand, the values for the other operations differ (though their 
syntactical composition is more or less equivalent). With n = 6 operations there arc 15 different combi- 
nations and thus possibly 15 values for Inter-Schema Coupling. Within the scope of this contribution we 
will focus on three combinations that arc of most interest in this schema constellation. 

As a first example we look at the operations Add and Add2. The difference between them is made up 
by just one prime, namely name' = name U {«?} at line 18. In fact, in the context of the specification this 
postcondition prime is redundant (as the state invariant at line 6 would guarantee that the added name is 
also in the set of names). But syntactically this prime is sufficient to increase the set of dependencies. 
Both operations include the state-space, which means that there is a relation between the postcondition 
primes and the invariant. This introduces a new ’’flow of control”, which increases the bandwidth and 
thus the value for coupling (from 0.724 to 0.737 in Fig. 2). 

Fig. 3 presents the values for Inter-Schema Flow and Coupling, and they make this difference more 
visible. Inter-Schema Flow F (BB.Add) is AIlFFktLJFL ^ w hich is 1 (so the slices of Add(S2) cover 100% 

of the state space BB{ SI)). F (Add ,BB) is where SU(BB) C\Add covers the primes at lines 

{6, 10, 11} (due to data dependency between line 6 and line 11). With this, the Inter-Schema Flow is 
(Please note that due to the schema inclusion the Add schema consists of 4 predicates!) Now, looking at 
Inter-Schema Coupling, the value is lxl ^ 4x4 , which is 0.8. Similarly, one can calculate the value for 
the coupling between BB(S 1) and Add2(S3), which is 0.833. The new dependency between the invariant 
at line 6 and line 1 8 led to the situation that the slice contains one more prime. For similar situations we 
might infer that the introduction of postcondition primes will (very likely) raise the value of coupling. 

Another situation occurs when looking at the operation schemata AddGift and AddGift2. In relation to 
the state schema the second valiant of the operation contains an additional prime at line 35. However, the 
point of departure is not the same. In this case the prime is a precondition prime that does not influence 
any primes outside the schema - at first sight. On closer examination it is clear that the postcondition 
primes in this schema arc control dependent upon this prime, and a slice ’’reaching” the schema operation 
will have to include this prime, too. It grows in size, meaning that more ’’bandwidth” is spent on it. In 
si mi lar situation we can infer that the value of coupling will also increase as the value for the Inter- 
Schema Flow increases from - to ++ 

The above specification does not show that the value for coupling can also decrease. This is the case 
when we introduce a postcondition prime that is not related to the primes in the other schema(ta). Then, 
in case of a state schema, there is no data-dependency between the primes. And in the case of another 
operation schema there is neither control nor data-dependency. As the size of the schema increases, 
Inter-Schema Flow decreases from - to 

m m+1 

On the syntactical level there is no difference between Add and AddGift. Both consist of a precon- 
dition prime, three postcondition primes, and include the state. This equivalence can be seen in Fig. 2 
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as the values for cohesion arc the same. But it gets interesting when comparing them to AddGiftl. The 
value for Inter-Schema Coupling between Add ( 52 ) and AddGift (55) is 0.750, whereas the value for 
Add (52) and AddGiftl (56) is 0.778. So, there is a slightly higher value of coupling between Add and 
AddGiftl. The reason for this is a semantic difference: the data relationship between the lines 1 1 and 34. 
This simple example demonstrates that the idea of the ’’bandwidth” is quite applicable in this situation. 

Though the above example is simple, it is able to demonstrate the effects on the value for coupling 
in the case of structural changes of schema operations. The second working hypothesis seems to be 
confirmed, at least from the analytical paid of view. 

3.3 Limitations 

Though the above hypotheses seem to be confirmed, there arc limitations. More precisely, the problems 
arc that (a) the specifications might be too dense, (b) only paid of the ’’bandwidth” is regarded, and (c) 
the dependency reconstruction does not work correctly. What seems to corrupt the measures is in fact 
not a real problem. 

In [2] the effect and efficiency of slicing has been investigated, and it turned out that slicing has dis- 
advantages when the specifications are too dense. In about 60-70% of all cases slicing led to a reduction 
in the size of the specification, which also means that in some situations there has been no reduction at 
all. The slices then contained all other primes - indicating that nearly every prime is related to all other 
primes. However, this effect decreases on average with raising sizes of the specifications (our experience 
relies on more than 45.000 lines of specification text), and it is only a problem with text-book examples 
that consist of a view schema operations only. 

The next concern is that coupling is not sensitive to changes that lead to an increase in the number 
of relations between the same primes. Irrespective the number of dependencies between two primes, 
only the occurrence of the primes is counted by the size-operator. Bandwidth does not increase then. 
The presented notion of coupling works well on a syntactical level, but not necessarily as expected 
on a semantic level. The last measure (comparing AddGift and AddGiftl ) was sensitive because one 
prime has (intentionally) been omitted from both schemata: normally, an author of these operations 
would have added the line date' = date as predicates to the schemata. This would have introduced 
data-dependencies from both schemata to the Add schema, and there would have been no difference in 
Inter-Schema Coupling anymore. In fact, this can not be seem as a real problem, it is as coupling is 
defined. Nevertheless, one has to keep in mind that there might be more dependencies as expected. 

Finally, slicing only works fine when the specifications are ’’well-formed”. This means that they 
consist of separable pre- and postconditions primes. When such a separation is not possible, then the 
outcome is vitiated. Diller mentions in [5, p. 165] that in most cases this separation can be done (which 
means that a syntactical approximation to the semantic analysis is possible), but this does not prevent 
from cases where pre- and postconditions arc interwoven and not separable. 


4 Conclusion and Outlook 

This contribution introduces the notion of specification slice -profiles that arc then used for the calculation 
of slice-based specification measures. The way of calculating these measures for Z (namely coupling and 
cohesion) is new and it is based on the use of (reconstructed) control and data dependency information. 
The objective of this work is to investigate if such a mapping is meaningful. For this, the contribution 
takes a set of small specifications as a basis, and the sensitivity of the measures is then analyzed by 
changing internal and external properties of the specifications. 
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The evaluation shows that the measures reflect the changes in the structure of the specification as 
expected. Especially the values for cohesion seem to be a good indicator for changes in internal proper- 
ties. Coupling is, due to the use of unions of slices a bit less sensitive, but it also reacts when there are 
dramatic structural changes. All in all, the measures proof useful. 

The understanding of the behavior of the measures was a first, necessary step. The next steps will 
be to include different ’’real-life” specifications and to perform an empirical study that demonstrates that 
the measures arc not just proxies for other, eventually size- based, measures. In case of confirming their 
unique features again, this could be a step towards taking specifications as quality indicators quite at the 
beginning of the SW-development cycle. 
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